Firewall
153
Trigger count before blocking specifies the number of times a host is permitted to
attempt to connect to a monitored service before being blocked. This option only takes
effect when one of the previous blocking options is enabled. The trigger count value
should be between 0 and 2 (o represents an immediate blocking of probing hosts).
Larger settings mean more attempts are permitted before blocking and although allowing
the attacker more latitude, these settings reduce the number of false positives.
Hosts to ignore for detection and block purposes is a list of host IP addresses which
the IDB ignores. This list may be freely edited so trusted servers and hosts are not
blocked. The two addresses 0.0.0.0 and 127.0.0.1 cannot be removed from the ignore
list because they represent the IDB host. You may enter the IP addresses as a range,
see the IP address ranges section further on for more information.
Dummy services
Specify the dummy services to monitor under the TDP and UDP tabs. Shortcut buttons
also provide pre-defined lists of services to monitor.
The Basic button installs a bare bones selection of ports to monitor while still providing
sufficient coverage to detect many intruder scans. The Standard option extends this
coverage by introducing additional monitored ports for early detection of intruder scans.
The Strict button installs a comprehensive selection of ports to monitor and should be
sufficient to detect most scans.
To Next Page
Loading...
Need help?
General
